/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote169 views1 answer
How to rename origin in git
Shell/Bash
0 vote280 views1 answer
Bat restart printer spooler
Shell/Bash
0 vote180 views3 answers
Linux ejecutar en segundo plano
Shell/Bash
0 vote208 views1 answer
Change run directory dockerfile
Shell/Bash
2 votes194 views1 answer
Bash get path from filename
Shell/Bash
16 votes299 views4 answers
Create a new branch based on another branch
Shell/Bash
0 vote194 views1 answer
Uninstall ubuntu keepalived
Shell/Bash
0 vote193 views1 answer
Nvidia open source driver arch linux
Shell/Bash
0 vote173 views1 answer
Angular install version 12
Shell/Bash
2 votes215 views1 answer
'json-server' is not recognized as an internal or external command, operable program or batch file.
Shell/Bash